Groups | Search | Server Info | Keyboard shortcuts | Login | Register [http] [https] [nntp] [nntps]


Groups > comp.sys.mac.system > #94839 > unrolled thread

Hidden SSID is Security Risk?

Started byDavoud <star@sky.net>
First post2016-09-27 21:20 -0400
Last post2016-09-29 21:56 +0000
Articles 20 on this page of 32 — 9 participants

Back to article view | Back to comp.sys.mac.system


Contents

  Hidden SSID is Security Risk? Davoud <star@sky.net> - 2016-09-27 21:20 -0400
    Re: Hidden SSID is Security Risk? nospam <nospam@nospam.invalid> - 2016-09-27 21:27 -0400
      Re: Hidden SSID is Security Risk? Jolly Roger <jollyroger@pobox.com> - 2016-09-28 01:38 +0000
    Re: Hidden SSID is Security Risk? Jolly Roger <jollyroger@pobox.com> - 2016-09-28 01:34 +0000
      Re: Hidden SSID is Security Risk? nospam <nospam@nospam.invalid> - 2016-09-27 21:36 -0400
        Re: Hidden SSID is Security Risk? Jolly Roger <jollyroger@pobox.com> - 2016-09-28 02:08 +0000
          Re: Hidden SSID is Security Risk? Patty Winter <patty1@wintertime.com> - 2016-09-28 04:40 +0000
            Re: Hidden SSID is Security Risk? befr@eaglesoft.de (Bernd Fröhlich) - 2016-09-28 08:59 +0200
              Re: Hidden SSID is Security Risk? Patty Winter <patty1@wintertime.com> - 2016-09-30 01:27 +0000
                Re: Hidden SSID is Security Risk? Davoud <star@sky.net> - 2016-09-30 13:20 -0400
          Re: Hidden SSID is Security Risk? "Happy.Hobo" <Happy.Hobo@Spam.Invalid> - 2016-09-28 12:40 -0500
            Re: Hidden SSID is Security Risk? Jolly Roger <jollyroger@pobox.com> - 2016-09-28 17:46 +0000
      Re: Hidden SSID is Security Risk? Patty Winter <patty1@wintertime.com> - 2016-09-28 04:39 +0000
        Re: Hidden SSID is Security Risk? Lewis <g.kreme@gmail.com.dontsendmecopies> - 2016-09-28 05:03 +0000
          Re: Hidden SSID is Security Risk? Alan Browne <alan.browne@freelunchvideotron.ca> - 2016-09-28 20:07 -0400
        Re: Hidden SSID is Security Risk? Jolly Roger <jollyroger@pobox.com> - 2016-09-28 16:41 +0000
          Re: Hidden SSID is Security Risk? JF Mezei <jfmezei.spamnot@vaxination.ca> - 2016-09-28 13:32 -0400
            Re: Hidden SSID is Security Risk? Alan Browne <alan.browne@freelunchvideotron.ca> - 2016-09-28 20:11 -0400
      Re: Hidden SSID is Security Risk? Alan Browne <alan.browne@freelunchvideotron.ca> - 2016-09-28 20:05 -0400
        Re: Hidden SSID is Security Risk? Davoud <star@sky.net> - 2016-09-28 23:22 -0400
          Re: Hidden SSID is Security Risk? Jolly Roger <jollyroger@pobox.com> - 2016-09-29 04:06 +0000
        Re: Hidden SSID is Security Risk? Jolly Roger <jollyroger@pobox.com> - 2016-09-29 04:06 +0000
          Re: Hidden SSID is Security Risk? JF Mezei <jfmezei.spamnot@vaxination.ca> - 2016-09-29 15:47 -0400
            Re: Hidden SSID is Security Risk? Jolly Roger <jollyroger@pobox.com> - 2016-09-29 21:01 +0000
              Re: Hidden SSID is Security Risk? JF Mezei <jfmezei.spamnot@vaxination.ca> - 2016-09-29 18:10 -0400
          Re: Hidden SSID is Security Risk? "Happy.Hobo" <Happy.Hobo@Spam.Invalid> - 2016-09-29 16:39 -0500
    Re: Hidden SSID is Security Risk? Alan Browne <alan.browne@freelunchvideotron.ca> - 2016-09-28 19:59 -0400
      Re: Hidden SSID is Security Risk? Jolly Roger <jollyroger@pobox.com> - 2016-09-29 00:20 +0000
        Re: Hidden SSID is Security Risk? Alan Browne <alan.browne@freelunchvideotron.ca> - 2016-09-28 20:39 -0400
        Re: Hidden SSID is Security Risk? "Happy.Hobo" <Happy.Hobo@Spam.Invalid> - 2016-09-29 16:47 -0500
          Re: Hidden SSID is Security Risk? Jolly Roger <jollyroger@pobox.com> - 2016-09-29 21:54 +0000
            Re: Hidden SSID is Security Risk? Jolly Roger <jollyroger@pobox.com> - 2016-09-29 21:56 +0000

Page 1 of 2  [1] 2  Next page →


#94839 — Hidden SSID is Security Risk?

FromDavoud <star@sky.net>
Date2016-09-27 21:20 -0400
SubjectHidden SSID is Security Risk?
Message-ID<270920162120121208%star@sky.net>
I opened my iPhone's WiFi settings to choose a different one of my
several wireless networks, all of which have hidden SSIDs. I saw the
message "Using a hidden network can expose personally identifiable
information. Configure your router to broadcast this network."

Huh? What personal information?

I'm not laboring under any delusions about hidden SSIDs providing a lot
of extra security‹I do that with proper passwords‹but I wasn't
expecting to see that a hidden SSID may compromise security.

-- 
I agree with almost everything that you have said and almost everything that
you will say in your entire life.

usenet *at* davidillig dawt cawm

[toc] | [next] | [standalone]


#94840

Fromnospam <nospam@nospam.invalid>
Date2016-09-27 21:27 -0400
Message-ID<270920162127345321%nospam@nospam.invalid>
In reply to#94839
In article <270920162120121208%star@sky.net>, Davoud <star@sky.net>
wrote:

> I opened my iPhone's WiFi settings to choose a different one of my
> several wireless networks, all of which have hidden SSIDs. I saw the
> message "Using a hidden network can expose personally identifiable
> information. Configure your router to broadcast this network."
> 
> Huh? What personal information?

ignore it.

> I'm not laboring under any delusions about hidden SSIDs providing a lot
> of extra security‹I do that with proper passwords‹but I wasn't
> expecting to see that a hidden SSID may compromise security.

it doesn't.

[toc] | [prev] | [next] | [standalone]


#94843

FromJolly Roger <jollyroger@pobox.com>
Date2016-09-28 01:38 +0000
Message-ID<e50l84FihnpU1@mid.individual.net>
In reply to#94840
nospam <nospam@nospam.invalid> wrote:
> In article <270920162120121208%star@sky.net>, Davoud <star@sky.net>
> wrote:
> 
>> I opened my iPhone's WiFi settings to choose a different one of my
>> several wireless networks, all of which have hidden SSIDs. I saw the
>> message "Using a hidden network can expose personally identifiable
>> information. Configure your router to broadcast this network."
>> 
>> Huh? What personal information?
> 
> ignore it.
> 
>> I'm not laboring under any delusions about hidden SSIDs providing a lot
>> of extra security‹I do that with proper passwords‹but I wasn't
>> expecting to see that a hidden SSID may compromise security.
> 
> it doesn't.

Yep. Hiding an SSID is a minimally effective way to deter only the most
casual users from seeing a network.

-- 
E-mail sent to this address may be devoured by my ravenous SPAM filter.
I often ignore posts from Google. Use a real news client instead.

JR

[toc] | [prev] | [next] | [standalone]


#94841

FromJolly Roger <jollyroger@pobox.com>
Date2016-09-28 01:34 +0000
Message-ID<e50l0fFig7jU1@mid.individual.net>
In reply to#94839
Davoud <star@sky.net> wrote:
> I opened my iPhone's WiFi settings to choose a different one of my
> several wireless networks, all of which have hidden SSIDs. I saw the
> message "Using a hidden network can expose personally identifiable
> information. Configure your router to broadcast this network."
> 
> Huh? What personal information?
> 
> I'm not laboring under any delusions about hidden SSIDs providing a lot
> of extra security‹I do that with proper passwords‹but I wasn't
> expecting to see that a hidden SSID may compromise security.

iOS and macOS remember the SSIDs of each network to which you connect.
Later, when the device scans for available networks, they broadcast those
SSIDs (including hidden ones) as part of the probe. The owner of a network
with a hidden SSID might not want that hidden SSID to be seen in those
probes, which is what that message is about.

-- 
E-mail sent to this address may be devoured by my ravenous SPAM filter.
I often ignore posts from Google. Use a real news client instead.

JR

[toc] | [prev] | [next] | [standalone]


#94842

Fromnospam <nospam@nospam.invalid>
Date2016-09-27 21:36 -0400
Message-ID<270920162136337646%nospam@nospam.invalid>
In reply to#94841
In article <e50l0fFig7jU1@mid.individual.net>, Jolly Roger
<jollyroger@pobox.com> wrote:

> > I opened my iPhone's WiFi settings to choose a different one of my
> > several wireless networks, all of which have hidden SSIDs. I saw the
> > message "Using a hidden network can expose personally identifiable
> > information. Configure your router to broadcast this network."
> > 
> > Huh? What personal information?
> > 
> > I'm not laboring under any delusions about hidden SSIDs providing a lot
> > of extra security?I do that with proper passwords?but I wasn't
> > expecting to see that a hidden SSID may compromise security.
> 
> iOS and macOS remember the SSIDs of each network to which you connect.
> Later, when the device scans for available networks, they broadcast those
> SSIDs (including hidden ones) as part of the probe. The owner of a network
> with a hidden SSID might not want that hidden SSID to be seen in those
> probes, which is what that message is about.

but it doesn't broadcast where that network happens to be (or any other
ssid in the scan).

[toc] | [prev] | [next] | [standalone]


#94844

FromJolly Roger <jollyroger@pobox.com>
Date2016-09-28 02:08 +0000
Message-ID<e50n19FinckU2@mid.individual.net>
In reply to#94842
On 2016-09-28, nospam <nospam@nospam.invalid> wrote:
> In article <e50l0fFig7jU1@mid.individual.net>, Jolly Roger
><jollyroger@pobox.com> wrote:
>
>> > I opened my iPhone's WiFi settings to choose a different one of my
>> > several wireless networks, all of which have hidden SSIDs. I saw the
>> > message "Using a hidden network can expose personally identifiable
>> > information. Configure your router to broadcast this network."
>> > 
>> > Huh? What personal information?
>> > 
>> > I'm not laboring under any delusions about hidden SSIDs providing a lot
>> > of extra security?I do that with proper passwords?but I wasn't
>> > expecting to see that a hidden SSID may compromise security.
>> 
>> iOS and macOS remember the SSIDs of each network to which you connect.
>> Later, when the device scans for available networks, they broadcast those
>> SSIDs (including hidden ones) as part of the probe. The owner of a network
>> with a hidden SSID might not want that hidden SSID to be seen in those
>> probes, which is what that message is about.
>
> but it doesn't broadcast where that network happens to be (or any other
> ssid in the scan).

Yep; though if you happen to be in the area of the network with the
hidden SSID, you'd be broadcasting the hidden SSID to anyone nearby. I
suppose if someone decided to name their hidden SSID with some sort of
personal identifying information (which would be foolish, admittedly),
you'd be broadcasting that information any time the device searches for
networks. None of this seems worthy of a warning message to me, though.
If anything, the owner of the hidden network is the one who should be
concerned about such things, rather than the person connecting. It's
really strange that Apple worded it the warning way they did and saw fit
to put it there at all. 

-- 
E-mail sent to this address may be devoured by my ravenous SPAM filter.
I often ignore posts from Google. Use a real news client instead.

JR

[toc] | [prev] | [next] | [standalone]


#94849

FromPatty Winter <patty1@wintertime.com>
Date2016-09-28 04:40 +0000
Message-ID<nsfhjk$2ma$2@dont-email.me>
In reply to#94844
In article <e50n19FinckU2@mid.individual.net>,
Jolly Roger  <jollyroger@pobox.com> wrote:
>
>I suppose if someone decided to name their hidden SSID with some sort of
>personal identifying information (which would be foolish, admittedly),

Mine is named after my cat.


Patty

[toc] | [prev] | [next] | [standalone]


#94855

Frombefr@eaglesoft.de (Bernd Fröhlich)
Date2016-09-28 08:59 +0200
Message-ID<1mua3k7.1u3xnlopgdpfkN%befr@eaglesoft.de>
In reply to#94849
Patty Winter <patty1@wintertime.com> wrote:

> Mine is named after my cat.

Cheshire? ;-)

[toc] | [prev] | [next] | [standalone]


#94950

FromPatty Winter <patty1@wintertime.com>
Date2016-09-30 01:27 +0000
Message-ID<nskf1t$guk$1@dont-email.me>
In reply to#94855
In article <1mua3k7.1u3xnlopgdpfkN%befr@eaglesoft.de>,
Bernd Fröhlich <befr@eaglesoft.de> wrote:
>Patty Winter <patty1@wintertime.com> wrote:
>
>> Mine is named after my cat.
>
>Cheshire? ;-)

No, but good guess! British shorthairs were supposedly the inspiration
for Dodgson's Cheshire Cat.


Patty

[toc] | [prev] | [next] | [standalone]


#94979

FromDavoud <star@sky.net>
Date2016-09-30 13:20 -0400
Message-ID<300920161320150833%star@sky.net>
In reply to#94950
Bernd Fröhlich:
> >Cheshire? ;-)

Patty Winter:
> No, but good guess! British shorthairs were supposedly the inspiration
> for Dodgson's Cheshire Cat.

Dodgson... Dodgson... Now where have I heard that name? Oh, yes. That
would be Anglican deacon Charles L. Dodgson, aka Lewis Carroll, who
wrote wonderful stories and who also photographed young girls in
various stages of déshabillé, including at least one photo of a
teenager (Lorina Liddell, older sister of Alice Liddell) with
full-frontal nudity, always with the girls' parents' permission. Neat
hobby back when one could get away with it! Possession of many of his
photographs would be a criminal offense today, would get a man labeled
as a sex offender. No, I don't have any of them (honest), but I have
seen a few in a private collection in the U.K. It has been argued that
Dodgson's photos are not erotic. They are. Two of his nudes and an
erotic portrait of Alice Liddell as a beggar girl may be seen at
<http://www.photography-news.com/2015/01/lewis-carrolls-haunting-photogr
aphs-of.html>.

-- 
I agree with almost everything that you have said and almost everything that
you will say in your entire life.

usenet *at* davidillig dawt cawm

[toc] | [prev] | [next] | [standalone]


#94870

From"Happy.Hobo" <Happy.Hobo@Spam.Invalid>
Date2016-09-28 12:40 -0500
Message-ID<nsgvb0$9ae$1@gioia.aioe.org>
In reply to#94844
On 09-27-2016 21:08, Jolly Roger wrote:
> you'd be broadcasting that information any time the device searches for
> networks. None of this seems worthy of a warning message to me, though.
> If anything, the owner of the hidden network is the one who should be
> concerned about such things, rather than the person connecting. It's

I would think that most of the time, the person connecting to a hidden 
SSID (legitimately) is the person who hid it.  In that case, the warning 
makes some sense, though it seems it would be more useful at the time of 
making it hidden.  But Apple probably can't add a warning to your router 
for you. :-)

[toc] | [prev] | [next] | [standalone]


#94872

FromJolly Roger <jollyroger@pobox.com>
Date2016-09-28 17:46 +0000
Message-ID<e52dvkF13dfU1@mid.individual.net>
In reply to#94870
On 2016-09-28, Happy.Hobo <Happy.Hobo@Spam.Invalid> wrote:
> On 09-27-2016 21:08, Jolly Roger wrote:
>> you'd be broadcasting that information any time the device searches for
>> networks. None of this seems worthy of a warning message to me, though.
>> If anything, the owner of the hidden network is the one who should be
>> concerned about such things, rather than the person connecting. It's
>
> I would think that most of the time, the person connecting to a hidden 
> SSID (legitimately) is the person who hid it.i

While I'm sure that's often the case, I'm not willing to make that
assumption. I have to think there are plenty of cases where the person
connecting isn't the owner of the hidden network.

> In that case, the warning makes some sense, though it seems it would
> be more useful at the time of making it hidden.  But Apple probably
> can't add a warning to your router for you. :-)

Apple certainly can display such a warning on an Apple router though.

-- 
E-mail sent to this address may be devoured by my ravenous SPAM filter.
I often ignore posts from Google. Use a real news client instead.

JR

[toc] | [prev] | [next] | [standalone]


#94848

FromPatty Winter <patty1@wintertime.com>
Date2016-09-28 04:39 +0000
Message-ID<nsfhhj$2ma$1@dont-email.me>
In reply to#94841
In article <e50l0fFig7jU1@mid.individual.net>,
Jolly Roger  <jollyroger@pobox.com> wrote:
>Davoud <star@sky.net> wrote:
>> I opened my iPhone's WiFi settings to choose a different one of my
>> several wireless networks, all of which have hidden SSIDs. I saw the
>> message "Using a hidden network can expose personally identifiable
>> information. Configure your router to broadcast this network."
>> 
>> Huh? What personal information?
>> 
>> I'm not laboring under any delusions about hidden SSIDs providing a lot
>> of extra security‹I do that with proper passwords‹but I wasn't
>> expecting to see that a hidden SSID may compromise security.
>
>iOS and macOS remember the SSIDs of each network to which you connect.
>Later, when the device scans for available networks, they broadcast those
>SSIDs (including hidden ones) as part of the probe. The owner of a network
>with a hidden SSID might not want that hidden SSID to be seen in those
>probes, which is what that message is about.

If they broadcast the SSIDs of both open and hidden networks, why doesn't
the message say something like, "Using a hidden network does not protect 
the privacy of all personally identifiable information"? The existing 
message makes it seem as though hidden networks are a greater security 
risk than open ones.


Patty

[toc] | [prev] | [next] | [standalone]


#94850

FromLewis <g.kreme@gmail.com.dontsendmecopies>
Date2016-09-28 05:03 +0000
Message-ID<slrnnumjpr.r77.g.kreme@snow.local>
In reply to#94848
In message <nsfhhj$2ma$1@dont-email.me> 
  Patty Winter <patty1@wintertime.com> wrote:

> In article <e50l0fFig7jU1@mid.individual.net>,
> Jolly Roger  <jollyroger@pobox.com> wrote:
>>Davoud <star@sky.net> wrote:
>>> I opened my iPhone's WiFi settings to choose a different one of my
>>> several wireless networks, all of which have hidden SSIDs. I saw the
>>> message "Using a hidden network can expose personally identifiable
>>> information. Configure your router to broadcast this network."
>>> 
>>> Huh? What personal information?
>>> 
>>> I'm not laboring under any delusions about hidden SSIDs providing a lot
>>> of extra security‹I do that with proper passwords‹but I wasn't
>>> expecting to see that a hidden SSID may compromise security.
>>
>>iOS and macOS remember the SSIDs of each network to which you connect.
>>Later, when the device scans for available networks, they broadcast those
>>SSIDs (including hidden ones) as part of the probe. The owner of a network
>>with a hidden SSID might not want that hidden SSID to be seen in those
>>probes, which is what that message is about.

> If they broadcast the SSIDs of both open and hidden networks, why doesn't
> the message say something like, "Using a hidden network does not protect 
> the privacy of all personally identifiable information"? The existing 
> message makes it seem as though hidden networks are a greater security 
> risk than open ones.

They are. Hidden networks are automatically a more tempting target.

-- 
These are the thoughts that kept me out of the really good schools. --
George Carlin

[toc] | [prev] | [next] | [standalone]


#94894

FromAlan Browne <alan.browne@freelunchvideotron.ca>
Date2016-09-28 20:07 -0400
Message-ID<gp-dnYAINaTFxnHKnZ2dnUU7-eOdnZ2d@giganews.com>
In reply to#94850
On 2016-09-28 01:03, Lewis wrote:
> In message <nsfhhj$2ma$1@dont-email.me>
>   Patty Winter <patty1@wintertime.com> wrote:
>
>> In article <e50l0fFig7jU1@mid.individual.net>,
>> Jolly Roger  <jollyroger@pobox.com> wrote:
>>> Davoud <star@sky.net> wrote:
>>>> I opened my iPhone's WiFi settings to choose a different one of my
>>>> several wireless networks, all of which have hidden SSIDs. I saw the
>>>> message "Using a hidden network can expose personally identifiable
>>>> information. Configure your router to broadcast this network."
>>>>
>>>> Huh? What personal information?
>>>>
>>>> I'm not laboring under any delusions about hidden SSIDs providing a lot
>>>> of extra security‹I do that with proper passwords‹but I wasn't
>>>> expecting to see that a hidden SSID may compromise security.
>>>
>>> iOS and macOS remember the SSIDs of each network to which you connect.
>>> Later, when the device scans for available networks, they broadcast those
>>> SSIDs (including hidden ones) as part of the probe. The owner of a network
>>> with a hidden SSID might not want that hidden SSID to be seen in those
>>> probes, which is what that message is about.
>
>> If they broadcast the SSIDs of both open and hidden networks, why doesn't
>> the message say something like, "Using a hidden network does not protect
>> the privacy of all personally identifiable information"? The existing
>> message makes it seem as though hidden networks are a greater security
>> risk than open ones.
>
> They are. Hidden networks are automatically a more tempting target.

One approach would be to buy some extra WiFi routers and set up both 
"real" looking SSID's to keep an attacker busy ... hook up the router to 
a Linux server with tons of disks with encrypted data (noise) and key 
files and all sorts of shit to keep 'em happy.


-- 
She hummed to herself because she was an unrivaled botcher of lyrics.
   -Nick (Gone Girl), Gillian Flynn.

[toc] | [prev] | [next] | [standalone]


#94866

FromJolly Roger <jollyroger@pobox.com>
Date2016-09-28 16:41 +0000
Message-ID<e52a62F7mvU1@mid.individual.net>
In reply to#94848
Patty Winter <patty1@wintertime.com> wrote:
> 
> In article <e50l0fFig7jU1@mid.individual.net>,
> Jolly Roger  <jollyroger@pobox.com> wrote:
>> Davoud <star@sky.net> wrote:
>>> I opened my iPhone's WiFi settings to choose a different one of my
>>> several wireless networks, all of which have hidden SSIDs. I saw the
>>> message "Using a hidden network can expose personally identifiable
>>> information. Configure your router to broadcast this network."
>>> 
>>> Huh? What personal information?
>>> 
>>> I'm not laboring under any delusions about hidden SSIDs providing a lot
>>> of extra security‹I do that with proper passwords‹but I wasn't
>>> expecting to see that a hidden SSID may compromise security.
>> 
>> iOS and macOS remember the SSIDs of each network to which you connect.
>> Later, when the device scans for available networks, they broadcast those
>> SSIDs (including hidden ones) as part of the probe. The owner of a network
>> with a hidden SSID might not want that hidden SSID to be seen in those
>> probes, which is what that message is about.
> 
> If they broadcast the SSIDs of both open and hidden networks, why doesn't
> the message say something like, "Using a hidden network does not protect 
> the privacy of all personally identifiable information"? The existing 
> message makes it seem as though hidden networks are a greater security 
> risk than open ones.

The person who is running the hidden network is the one who should be
concerned that their hidden SSID is broadcasted. For the person connecting
to the network it really doesn't matter whether it's hidden or not - nor
does it matter whether the SSID is broadcast. So personally I wouldn't
display a message at all on iOS.

-- 
E-mail sent to this address may be devoured by my ravenous SPAM filter.
I often ignore posts from Google. Use a real news client instead.

JR

[toc] | [prev] | [next] | [standalone]


#94869

FromJF Mezei <jfmezei.spamnot@vaxination.ca>
Date2016-09-28 13:32 -0400
Message-ID<57ebfeae$0$7401$c3e8da3$66d3cc2f@news.astraweb.com>
In reply to#94866
My understanding (hoping someone will correct me professionally) is:

When your phone is set to autoconnect to a hidden SSID, because it
cannot see it before attempting to connect to it, it needs to try to
connect to it blindly to see if there is a response. This means that
whenever it not connected to another wi-fi, the phone regularly sends a
packet to that SSID in case there would be a response.

I do not know what that packet says, but that appears to be where the
leak of information comes from.

[toc] | [prev] | [next] | [standalone]


#94895

FromAlan Browne <alan.browne@freelunchvideotron.ca>
Date2016-09-28 20:11 -0400
Message-ID<naydnVqh_rKpwXHKnZ2dnUU7-aXNnZ2d@giganews.com>
In reply to#94869
On 2016-09-28 13:32, JF Mezei wrote:
> My understanding (hoping someone will correct me professionally) is:
>
> When your phone is set to autoconnect to a hidden SSID, because it
> cannot see it before attempting to connect to it, it needs to try to
> connect to it blindly to see if there is a response. This means that
> whenever it not connected to another wi-fi, the phone regularly sends a
> packet to that SSID in case there would be a response.
>
> I do not know what that packet says, but that appears to be where the
> leak of information comes from.

Which is meaninglessly useless near the WiFi using the hidden SSID - but 
mapable and useful (in the somewhat extremes of obscurity) to those who 
like to map such and make correlations.

Say you're in China and your iPhone goes looking for the 
"ultrasecret-lab" SSID.  Then the Chinese government (hackers) know 1) 
You (they know all about you and your company) and the name of your 
company SSID.  They now know just a little bit more.  And there are data 
bases out there that only exist to discover, one little nugget at a 
time, as much about you or the company you work for.

This is really edge of the edge case.

-- 
She hummed to herself because she was an unrivaled botcher of lyrics.
   -Nick (Gone Girl), Gillian Flynn.

[toc] | [prev] | [next] | [standalone]


#94893

FromAlan Browne <alan.browne@freelunchvideotron.ca>
Date2016-09-28 20:05 -0400
Message-ID<gp-dnYEINaQqx3HKnZ2dnUU7-eOdnZ2d@giganews.com>
In reply to#94841
On 2016-09-27 21:34, Jolly Roger wrote:
> Davoud <star@sky.net> wrote:
>> I opened my iPhone's WiFi settings to choose a different one of my
>> several wireless networks, all of which have hidden SSIDs. I saw the
>> message "Using a hidden network can expose personally identifiable
>> information. Configure your router to broadcast this network."
>>
>> Huh? What personal information?
>>
>> I'm not laboring under any delusions about hidden SSIDs providing a lot
>> of extra security‹I do that with proper passwords‹but I wasn't
>> expecting to see that a hidden SSID may compromise security.
>
> iOS and macOS remember the SSIDs of each network to which you connect.
> Later, when the device scans for available networks, they broadcast those
> SSIDs (including hidden ones) as part of the probe. The owner of a network
> with a hidden SSID might not want that hidden SSID to be seen in those
> probes, which is what that message is about.

Not like he has much choice if the user side leave the network area and 
come back.  It will be broadcasting.  There, everywhere (unless there's 
some location filtering to reduce that side of it).

So what's the message?

If user A uses his home or company hidden WiFi SSID and he's out and 
about in the world, that SSID is being ping'd about looking for mama WiFi.

If someone else (mr. X) happened to discover that SSID (back home where 
it is) and logged the coordinates of it (but not able to use it), then 
whoever in the world broadcast that same SSID pinging to find mama could 
be linked to "A"'s home/work WiFi area.

A bit of very obscure identity tracking?  Is that what Apple are worried 
about?

-- 
She hummed to herself because she was an unrivaled botcher of lyrics.
   -Nick (Gone Girl), Gillian Flynn.

[toc] | [prev] | [next] | [standalone]


#94913

FromDavoud <star@sky.net>
Date2016-09-28 23:22 -0400
Message-ID<280920162322481202%star@sky.net>
In reply to#94893
Alan Browne:
> Not like he has much choice if the user side leave the network area and 
> come back.  It will be broadcasting.  There, everywhere (unless there's 
> some location filtering to reduce that side of it).
> 
> So what's the message?
> 
> If user A uses his home or company hidden WiFi SSID and he's out and 
> about in the world, that SSID is being ping'd about looking for mama WiFi.
> 
> If someone else (mr. X) happened to discover that SSID (back home where 
> it is) and logged the coordinates of it (but not able to use it), then 
> whoever in the world broadcast that same SSID pinging to find mama could 
> be linked to "A"'s home/work WiFi area.
> 
> A bit of very obscure identity tracking?  Is that what Apple are worried 
> about?

Indeed! If that's all, no sweat. Anyone who wants to know my identity
can ask me. Or read my e-mail address, which includes my first and last
names, at the end of this post. Then they can look me up in the
Baltimore phone book. Or they can visit my Flickr page--it has my name
on it and I leave the EXIF on my photos because certain organizations
that harvest some of my Flickr photos (Encyclopedia of Life and The
Maryland Biodiversity Project) need GPS data on the photo. In the
course of my traveling career I handed my ID to scores of governments
around the world, many of them hostile. The PRC hacked OPM and stole
some of my annuity records. I can think of a hundred ways someone can
identify me and my location, and you can probably think of a hundred
more. So someone learning that I have a "hidden" WiFi network at home
named "pyramid" does not seem like the end of the world to me.
Especially since said network is in a semi-rural area quite a distance
from a road where no one stops or parks without being noticed.

BTW, the router in question--the one Apple tells me to reconfigure to
reveal the SSID--is an Apple-brand Airport Base Station. So why did
Apple make it capable of hiding the SSID if that's Bad?

P.S. I drive a Lexus with Lexus Enform (Enform, Inform--get it?)
active. The car has its own cellular comms system. Lexus can read my
GPS data even when the car is turned off. Lexus will program my GPS
remotely if I request it. I get an e-mail every month with a vehicle
diagnostic--miles driven, oil quantity and condition, other maintenance
data. I get e-mails from the car from time to time telling me where it
is. With Enform I don't have to worry whether Big Brother is watching;
I *know* he is. And Big Brother is so clever he makes *me* pay an
annual fee for him to watch me!

-- 
I agree with almost everything that you have said and almost everything that
you will say in your entire life.

usenet *at* davidillig dawt cawm

[toc] | [prev] | [next] | [standalone]


Page 1 of 2  [1] 2  Next page →

Back to top | Article view | comp.sys.mac.system


csiph-web